This vulnerability is a classic SQL Injection flaw caused by improper neutralization of special elements in SQL commands. It permits an attacker to inject arbitrary SQL statements into the WordPress database, allowing unauthorized reading, modification, or deletion of data stored by the site. The weakness is classified as CWE-89.

WordPress sites that include the jerodmoore eDoc Easy Tables plugin version 1.29 or earlier are vulnerable. The issue resides in the plugin code that constructs database queries without proper parameterization or escaping.

The CVSS v3 score of 8.5 signifies a high risk if exploitation succeeds. The EPSS score of less than 1% indicates a low current probability of exploitation, yet the flaw can still be used in the wild, especially on sites without hardening. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an external attacker crafting HTTP requests to the plugin’s endpoints, which are exposed on the publicly reachable WordPress site. Successful exploitation grants database access corresponding to the credentials used by WordPress, enabling data theft and potential persistence.